Why 'Zero Day' Android Hacking Now Costs More Than iOS Attacks

Brokers of so-called zero day exploits are paying out more for Android than iOS—which would have been unthinkable until recently...

Apple iOS < 12.4.1 Privilege Escalation Vulnerability

Binary data appleios1241check.nbin...

iMessage - NSKeyedUnarchiver Deserialization Allows file Backed NSData Objects Exploit

The class NSDataFileBackedFuture can be deserialized even if secure encoding is enabled. This class is a file-backed NSData object that loads a local file into memory when the NSData bytes selector is called. This presents two problems. First, it could potentially allow undesired access to local...

iOS 12.1.3 cfprefsd Memory Corruption

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. include import include include include include include define AGENT 1 define FILLDICTCOUNT 0x600 define FILLCOUNT 0x1000 define FREECOU...

iOS 12.1.3 - cfprefsd Memory Corruption

iOS 12.1.3 - cfprefsd Memory Corruption // c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. include import include include include include include define AGENT 1 define FILLDICTCOUNT 0x60...

iOS 12.1.3 - 'cfprefsd' Memory Corruption

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. include import include include include include include define AGENT 1 define FILLDICTCOUNT 0x600 define FILLCOUNT 0x1000 define FREECOU...

Code injection

A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1...

CVE-2018-4380

CVE-2018-4380 describes a lock-screen information disclosure in iOS prior to 12.0.1, where a local attacker could view photos and contacts from the lock screen. The issue was addressed in iOS 12.0.1 by restricting options offered on a locked device. Affected versions: prior to iOS 12.0.1. Exploit...

CVE-2018-4430

CVE-2018-4430 describes a lock-screen vulnerability in iOS where an attacker could access contacts on a locked device. The Red Hat and NVD entries mirror the Apple advisory, stating the issue affected versions prior to iOS 12.1.1 and was addressed by improved state management. The Apple security ...

CVE-2018-4435

CVE-2018-4435 is a kernel-level logic issue addressed by Apple across multiple platforms. According to the initial entry, the vulnerability affected iOS before 12.1.1, macOS Mojave before 10.14.2, tvOS before 12.1.1, and watchOS before 5.1.2, and was fixed by applying improved restrictions. Suppo...

CVE-2018-4387

CVE-2018-4387 affects Apple iOS prior to 12.1. Description: a lock-screen vulnerability allowing access to photos via Reply With Message on a locked device, addressed by improved state management. Affected: iOS versions before 12.1. Reported in multiple sources (NVD entry and Red Hat CVE page) wi...

CVE-2018-4366

CVE-2018-4366 is an out-of-bounds read in FaceTime video processing that occurs on Macs, caused by memory corruption with improper input validation. It affects versions prior to iOS 12.1 (per the vulnerability description and Apple’s entry). The issue’s impact is memory corruption potentially lea...

CVE-2018-4367

CVE-2018-4367 is a memory-related vulnerability described as a stack corruption issue that affected iOS and macOS (prior to iOS 12.1). Apple’s entry ties it to FaceTime, noting a memory corruption problem resolved by improved input validation and patched in iOS 12.1. The NVD entry likewise states...

CVE-2018-4284

CVE-2018-4284 describes a type confusion vulnerability that was addressed with improved memory handling. It affected multiple Apple software versions prior to patches: iOS 11.4.1 and earlier, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, and iCloud for Windows 7.6. The initi...

CVE-2019-6217

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution...

About the security content of Shortcuts 2.1.3 for iOS - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

CVE-2017-13888

In iOS before 11.2, a type confusion issue was addressed with improved memory handling...

CVE-2017-2411

In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates...

Type confusion

In iOS before 11.2, a type confusion issue was addressed with improved memory handling...

CVE-2018-4208

CVE-2018-4208 describes an assertion failure caused by an unexpected interaction in WebKit components across Apple platforms (iOS, Safari, iCloud for Windows, tvOS, watchOS, iTunes for Windows). The description indicates that the issue affected multiple surfaces and was addressed by “improved che...